[foozzie] Mock out setting NaN values in DataViews

Bug: chromium:1091698
Change-Id: Ida82d262f409c54e59640bcaa026879d18ff178d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252184
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68439}

test/mjsunit/tools/foozzie.js

@@ -59,8 +59,8 @@ function testArrayType(arrayType, pattern) {
     arr[0] = -NaN;
     return new Uint32Array(arr.buffer);
   };
-  // Test passing NaN using set.
   testSameOptimized(pattern, create);
+  // Test passing NaN using set.
   create = function() {
     const arr = new arrayType(1);
     arr.set([-NaN], 0);
@@ -78,6 +78,20 @@ else {
   testArrayType(Float64Array, [0, 1072693248]);
 }
 
+// Test that DataView has the same NaN patterns with optimized and
+// unoptimized code.
+testSameOptimized([4213246272,405619796,61503,0,3675212096,32831], () => {
+  const array = new Uint32Array(6);
+  const view = new DataView(array.buffer);
+  view.setFloat64(0, Math.PI);
+  view.setFloat64(8, -undefined);
+  view.setFloat32(16, Math.fround(Math.PI));
+  view.setFloat32(20, -undefined);
+  assertEquals(Math.PI, view.getFloat64(0));
+  assertEquals(Math.fround(Math.PI), view.getFloat32(16));
+  return array;
+});
+
 // Realm.eval is just eval.
 assertEquals(1477662728716, Realm.eval(Realm.create(), `Date.now()`));
 

tools/clusterfuzz/v8_mock.js

@@ -149,6 +149,20 @@ Object.defineProperty(
   Float64Array = mock(Float64Array);
 })();
 
+// Mock buffer access via DataViews because of varying NaN patterns.
+(function() {
+  const origIsNaN = isNaN;
+  const deNaNify = function(value) { return origIsNaN(value) ? 1 : value; };
+  const origSetFloat32 = DataView.prototype.setFloat32;
+  DataView.prototype.setFloat32 = function(offset, value, ...rest) {
+    origSetFloat32.call(this, offset, deNaNify(value), ...rest);
+  };
+  const origSetFloat64 = DataView.prototype.setFloat64;
+  DataView.prototype.setFloat64 = function(offset, value, ...rest) {
+    origSetFloat64.call(this, offset, deNaNify(value), ...rest);
+  };
+})();
+
 // Mock Worker.
 (function() {
   let index = 0;